A core infrastructure engineer pleads guilty to federal charges in insider attack

Critically, he argued that the use of various tools should be instantly flagged as concerning. “Instrument Task Scheduler, PsExec, PsPasswd, and net user are high‑risk signals. These are the insider’s equivalent of lockpicks,” he said. “They should generate behavioral alerts when used at scale, off‑hours, or from unusual hosts.”

Levine also suggested extensive system monitoring. “If someone is RDP’ing into a domain controller at 7:48 a.m. and creating 16 scheduled tasks, you should have a video‑like audit trail.”

Paul Furtado, a distinguished VP analyst at Gartner, said he encourages clients to make sure that no single admin can cause this kind of damage. 

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts